netdev - Re: [PATCH net-next v4 0/3] Fix late DMA unmap crash for page pool

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <87bjtlpfke.fsf@toke.dk>
Date: Fri, 28 Mar 2025 12:20:17 +0100
From: Toke Høiland-Jørgensen <toke@...hat.com>
To: Jakub Kicinski <kuba@...nel.org>
Cc: "David S. Miller" <davem@...emloft.net>, Jesper Dangaard Brouer
 <hawk@...nel.org>, Saeed Mahameed <saeedm@...dia.com>, Leon Romanovsky
 <leon@...nel.org>, Tariq Toukan <tariqt@...dia.com>, Andrew Lunn
 <andrew+netdev@...n.ch>, Eric Dumazet <edumazet@...gle.com>, Paolo Abeni
 <pabeni@...hat.com>, Ilias Apalodimas <ilias.apalodimas@...aro.org>, Simon
 Horman <horms@...nel.org>, Andrew Morton <akpm@...ux-foundation.org>, Mina
 Almasry <almasrymina@...gle.com>, Yonglong Liu <liuyonglong@...wei.com>,
 Yunsheng Lin <linyunsheng@...wei.com>, Pavel Begunkov
 <asml.silence@...il.com>, Matthew Wilcox <willy@...radead.org>,
 netdev@...r.kernel.org, bpf@...r.kernel.org, linux-rdma@...r.kernel.org,
 linux-mm@...ck.org, Qiuling Ren <qren@...hat.com>, Yuying Ma
 <yuma@...hat.com>
Subject: Re: [PATCH net-next v4 0/3] Fix late DMA unmap crash for page pool

Jakub Kicinski <kuba@...nel.org> writes:

> On Thu, 27 Mar 2025 11:44:10 +0100 Toke Høiland-Jørgensen wrote:
>> This series fixes the late dma_unmap crash for page pool first reported
>> by Yonglong Liu in [0]. It is an alternative approach to the one
>> submitted by Yunsheng Lin, most recently in [1]. The first two commits
>> are small refactors of the page pool code, in preparation of the main
>> change in patch 3. See the commit message of patch 3 for the details.
>
> We see a crash and an UAF on:
>
> [   18.574787] RIP: 0010:page_pool_put_unrefed_netmem (net/core/page_pool.c:465 net/core/page_pool.c:808 net/core/page_pool.c:866) 
> [   18.575880] napi_pp_put_page (net/core/skbuff.c:998) 
> [   18.575912] skb_release_data (./include/linux/skbuff_ref.h:40 ./include/linux/skbuff_ref.h:56 net/core/skbuff.c:1079) 
> [   18.575944] consume_skb (net/core/skbuff.c:1165 net/core/skbuff.c:1396 net/core/skbuff.c:1390) 
>
> You should be able to repro with ping test over netdevsim

Alright, I'll take a look, thanks for the pointer.

-Toke